Riddle & Butts LLP Data Breach Case

From the AG filing description

Riddle & Butts LLP operates as a prominent professional services organization, specifically within the legal sector, handling complex litigation, corporate counsel, intellectual property matters, and sensitive client advisory services. Because law firms routinely manage high-stakes commercial disputes, confidential corporate transactions, and extensive personal legal matters, they accumulate vast repositories of highly confidential information. This includes not only internal employee payroll and personnel records, but also privileged client files, corporate financial statements, trade secrets, and extensive personally identifiable information (PII) belonging to individuals involved in ongoing legal proceedings. The necessity of maintaining accessible digital repositories for case management, discovery documents, and billing systems makes legal practices prime targets for malicious actors seeking to exploit valuable and sensitive data. The security incident reported by Riddle & Butts LLP to the Indiana Attorney General in 2026 highlights the persistent vulnerabilities facing law firms and professional services providers in an era of sophisticated cyber threats. While the full forensic scope continues to be evaluated, incidents of this nature typically involve unauthorized third-party access to internal network infrastructure, compromised employee credentials, or sophisticated malware attacks targeting legacy databases. Law firm networks are frequently targeted because they serve as central hubs connecting multiple third-party vendors, co-counsel, expert witnesses, and financial institutions, creating a complex attack surface where a single point of entry can compromise vast quantities of sensitive documentation across multiple practice groups. The exposure resulting from this breach compromises several categories of sensitive data, each carrying distinct and severe risks for affected individuals. Compromised files often include full names, dates of birth, Social Security numbers, banking and wire transfer instructions, tax identification documents, and confidential case records containing intimate personal or corporate financial details. When Social Security numbers and financial data are leaked, victims face an immediate and prolonged risk of identity theft, fraudulent credit card applications, unauthorized bank account takeovers, and tax fraud. In the context of a law firm breach, the compromise of confidential legal documentation can also expose individuals to targeted extortion, targeted phishing schemes, and severe privacy violations that undermine the very matters for which they sought legal representation. Under federal and state law, including the Indiana Disclosure of Security Breach Law and applicable common law duties, Riddle & Butts LLP had an affirmative legal obligation to implement and maintain reasonable security procedures and practices to safeguard sensitive PII entrusted to their care. These legal obligations require robust encryption standards, multi-factor authentication, regular vulnerability assessments, and strict access controls to prevent unauthorized exfiltration. The occurrence of a data breach of this magnitude serves as a strong indication that these mandated administrative, physical, and technical safeguards may have been inadequate or improperly maintained, representing a potential failure of the firm's duty of care to its clients, employees, and associated third parties. Receiving an official data action breach notification letter from Riddle & Butts LLP is a formal acknowledgement that your private information was compromised due to inadequate security measures. Legally, the receipt of this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the firm accountable for its negligence. Under the law, affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to pursue legal recourse; the mere increased risk of future harm is sufficient. Our law firm is actively investigating this breach and evaluates potential claims on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.